Langflow – the open-source platform that lets developers stitch together LLM prompts, data sources and custom Python code – has a critical flaw that lets anyone run arbitrary Python on a vulnerable server. CVE-2026-33017, rated 9.8 on the CVSS scale, affects every version prior to 1.9.0 and can be triggered without authentication, forcing operators to upgrade or turn off the “public flow” feature.
What the bug does
Langflow’s public-flow endpoint was meant for demo-style chatbots that anyone can try without logging in. The endpoint accepts a data parameter in the request body, assumes the payload contains a safe flow definition, and then hands the content straight to Python’s built-in exec() function. exec() evaluates the string as code and runs it with the same privileges as the Langflow process.
An attacker only needs the public flow’s ID – a value often shown in shared URLs – to craft a request that swaps in a malicious flow definition. When the server processes the request, the injected Python runs immediately, giving the attacker full control over the host system.
How the vulnerability slipped through
In earlier releases the code path that loads a flow from the database was bypassed when a data field was present. Instead of sanitising or validating the payload, the server trusted the caller and executed it verbatim. Because the endpoint is reachable without any login, the attack surface is the public internet for any Langflow instance that has public flows enabled.
Who is at risk
Given the severity score, the vulnerability is considered “critical”.
Immediate mitigation steps
- Upgrade to Langflow 1.9.0 – this is the only verified fix.
- Disable the public flow feature if you do not need anonymous access.
- Turn off AUTO_LOGIN – this stops automatic session creation for unauthenticated requests.
- Place the API behind a firewall or reverse proxy to limit access to trusted IP ranges.
- Deploy a Web Application Firewall (WAF) that blocks requests to the
build_public_tmpendpoint containing adataparameter.
Why the fix matters
The vulnerability exploits a fundamental design mistake: trusting user-supplied code in a context that runs with high privileges. By removing that trust and enforcing stricter input handling, Langflow 1.9.0 restores the barrier between public demo users and the underlying server.
What to watch next
- Community response – monitor the Langflow repository for follow-up patches or advisories.
Bottom line: Any Langflow deployment exposing the public-flow endpoint must be patched today. Until version 1.9.0 is running, shut the feature down and barricade the service behind network controls. The cost of a breach far exceeds the effort of a quick upgrade.